urlscan.io logo urlscan.io
SecurityTrails logo

original.su Open in urlscan Pro
5.63.153.198  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://s3.amazonaws.com/d4araoneillhjjufggf/oevkonto.html
Effective URL: https://original.su/company/dokumenty/ch/login.php
Submission: On October 17 via manual from ZA — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 5.63.153.198, located in London, United Kingdom and belongs to AS-REG, RU. The main domain is original.su.
TLS certificate: Issued by R3 on August 5th 2023. Valid for: 3 months.
This is the only time original.su was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 52.216.222.64 16509 (AMAZON-02)
1 9 5.63.153.198 197695 (AS-REG)
9 2
Apex Domain
Subdomains		 Transfer
9 original.su
original.su
377 KB
1 amazonaws.com
s3.amazonaws.com
736 B
9 2
Domain Requested by
9 original.su 1 redirects s3.amazonaws.com
original.su
1 s3.amazonaws.com
9 2

This site contains links to these domains. Also see Links.

Domain
www.swisspass.ch
login.swisspass.ch
Subject Issuer Validity Valid
s3.amazonaws.com
Amazon RSA 2048 M01		 2023-07-10 -
2024-06-21		 a year crt.sh
original.su
R3		 2023-08-05 -
2023-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://original.su/company/dokumenty/ch/login.php
Frame ID: 148CD155FE14AE701230F851CF161232
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Swiss Pass

Page URL History Show full URLs

  1. https://s3.amazonaws.com/d4araoneillhjjufggf/oevkonto.html Page URL
  2. https://original.su/company/dokumenty/ch/go.php HTTP 302
    https://original.su/company/dokumenty/ch/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

377 kB
Transfer

460 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s3.amazonaws.com/d4araoneillhjjufggf/oevkonto.html Page URL
  2. https://original.su/company/dokumenty/ch/go.php HTTP 302
    https://original.su/company/dokumenty/ch/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
oevkonto.html
s3.amazonaws.com/d4araoneillhjjufggf/ 		209 B
736 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/d4araoneillhjjufggf/oevkonto.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.222.64 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
209
Content-Type
text/html
Date
Tue, 17 Oct 2023 10:50:35 GMT
ETag
"5df4caccc52a5c920b7a16ea223e1a64"
Last-Modified
Tue, 17 Oct 2023 08:06:14 GMT
Server
AmazonS3
x-amz-id-2
3WQfiLetHOw7AFbdyN4FwtTZZb97rchghzej3+9VR6zk4LEbunOIUU7FYio1NucWYEhF5Fy+iGc=
x-amz-meta-s3b-last-modified
20231017T080259Z
x-amz-meta-sha256
9b112bd19fde419f0bebdbe2d37b7e56a0408fffcc8f6043c935b6e9f0ec71ba
x-amz-request-id
E5XA4YM8ECMSMJAG
x-amz-server-side-encryption
AES256
Primary Request login.php
original.su/company/dokumenty/ch/
Redirect Chain
  • https://original.su/company/dokumenty/ch/go.php
  • https://original.su/company/dokumenty/ch/login.php
17 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://original.su/company/dokumenty/ch/login.php
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/d4araoneillhjjufggf/oevkonto.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
ef81e4c69a7b30b9697a08da20453c10772bf95eec7fa46207f9d505498ff6e4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://s3.amazonaws.com/d4araoneillhjjufggf/oevkonto.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Security-Policy
upgrade-insecure-requests
Content-Type
text/html; charset=UTF-8
Date
Tue, 17 Oct 2023 10:50:36 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx/1.16.1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Security-Policy
upgrade-insecure-requests
Content-Type
text/html; charset=UTF-8
Date
Tue, 17 Oct 2023 10:50:36 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
login.php
Pragma
no-cache
Server
nginx/1.16.1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Transfer-Encoding
chunked
sso.min-20200819.css
original.su/company/dokumenty/ch/filez/ 		81 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://original.su/company/dokumenty/ch/filez/sso.min-20200819.css
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
c0494f89be7292d192faee79f6ac5f93e95ded69207b73ff4660bb203017bcbc
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://original.su/company/dokumenty/ch/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Wed, 09 Aug 2023 07:02:56 GMT
Server
nginx/1.16.1
ETag
W/"64d33a20-143f0"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
keep-alive
Expires
Thu, 16 Nov 2023 10:50:36 GMT
logo.png
original.su/company/dokumenty/ch/filez/ 		548 B
974 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://original.su/company/dokumenty/ch/filez/logo.png
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
f2f0d94a5141a75ef227f2699b6a43588741ede3edd2fe2d075a65b3d413b2f8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://original.su/company/dokumenty/ch/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Tue, 08 Aug 2023 18:59:08 GMT
Server
nginx/1.16.1
ETag
"64d2907c-224"
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
548
Expires
Thu, 16 Nov 2023 10:50:36 GMT
logo_text_de-20200819.svg
original.su/company/dokumenty/ch/filez/ 		137 KB
137 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://original.su/company/dokumenty/ch/filez/logo_text_de-20200819.svg
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://original.su/company/dokumenty/ch/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Tue, 08 Aug 2023 18:59:08 GMT
Server
nginx/1.16.1
ETag
"64d2907c-222c3"
Content-Type
image/svg+xml
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
139971
Expires
Thu, 16 Nov 2023 10:50:36 GMT
logo-20200819.svg
original.su/company/dokumenty/ch/filez/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://original.su/company/dokumenty/ch/filez/logo-20200819.svg
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://original.su/company/dokumenty/ch/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Tue, 08 Aug 2023 18:59:08 GMT
Server
nginx/1.16.1
ETag
"64d2907c-1cce"
Content-Type
image/svg+xml
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7374
Expires
Thu, 16 Nov 2023 10:50:36 GMT
login_bg.jpg
original.su/company/dokumenty/ch/filez/ 		196 KB
197 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://original.su/company/dokumenty/ch/filez/login_bg.jpg
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://original.su/company/dokumenty/ch/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Tue, 08 Aug 2023 18:59:08 GMT
Server
nginx/1.16.1
ETag
"64d2907c-310e5"
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
200933
Expires
Thu, 16 Nov 2023 10:50:36 GMT
SBBWeb-Light.woff2
original.su/company/dokumenty/ch/filez/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://original.su/company/dokumenty/ch/filez/SBBWeb-Light.woff2
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/filez/sso.min-20200819.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://original.su/company/dokumenty/ch/filez/sso.min-20200819.css
Origin
https://original.su
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Tue, 08 Aug 2023 18:59:08 GMT
Server
nginx/1.16.1
ETag
"3784-6026df5281700"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14212
icomoon.woff2
original.su/company/dokumenty/ch/filez/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://original.su/company/dokumenty/ch/filez/icomoon.woff2
Requested by
Host: original.su
URL: https://original.su/company/dokumenty/ch/filez/sso.min-20200819.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
5.63.153.198 London, United Kingdom, ASN197695 (AS-REG, RU),
Reverse DNS
5-63-153-198.cloudvps.regruhosting.ru
Software
nginx/1.16.1 /
Resource Hash
45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://original.su/company/dokumenty/ch/filez/sso.min-20200819.css
Origin
https://original.su
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date
Tue, 17 Oct 2023 10:50:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Tue, 08 Aug 2023 18:59:08 GMT
Server
nginx/1.16.1
ETag
"1b20-6026df5281700"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6944

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
original.su/ Name: PHPSESSID
Value: 4doshigd8ids7ev587c4m5h7nj